# 🤖 infra/dev-mesh — the AWS half of the two-node dev mesh

The Dublin (`ie`) node of the relaxed, cut-off staging fleet. Design + the
prod per-country model it rehearses: `docs/dev-mesh.md`. Its own tofu state
(`dev-mesh/terraform.tfstate`) so it tears down independently of the `#550`
activator box in `infra/dev`.

Manages the static skeleton only: the EC2 box + EIP, its security group, the
instance role, the shared `eleven-dev-mesh-*` S3 bucket, the Helsinki node's
scoped IAM user, the **Route53 `dev.11ch.at` hosted zone** (delegated from the
prod `11ch.at` DNSimple zone) and its wildcards, and the DNS-01 IAM the boxes
use to obtain the shared `*.dev.11ch.at` cert. The Helsinki (`fi`) node itself
is Hetzner, hand-provisioned like prod's Hetzner boxes.

**DNS lives in Route53 now** (`route53.tf`): `dev.11ch.at` is its own hosted
zone in the dev AWS account, NS-delegated from DNSimple (`dns.tf`). That is the
region-neutral base domain for multi-edge Phase 1 — new spaces mint as
`<sqid>.dev.11ch.at` and both boxes obtain the `*.dev.11ch.at` wildcard cert
over Route53 DNS-01 with their AWS role/user, no DNS token on a box
(`route53dns.go`, `LCHAT_DNS_PROVIDER=route53`). The per-country
`*.ie.dev` / `*.fi.dev` wildcards moved into this zone too (the delegation makes
DNSimple non-authoritative below `dev.11ch.at`). DNSimple keeps only the `dev`
NS delegation and the `home.dev.elevenmessenger.com` A record. Cutover +
box-reconfig runbook: `docs/multi-edge-dev-cutover.md`.

```sh
# plan (with the AMI-replacement guard) — credentials come from your
# per-operator dev agent item in Bitwarden automatically (AWS_* + DNSIMPLE_*;
# the DNSimple token lives in the Eleven account, 176940):
./deploy/ops dev plan

# apply behind the same guard (tofu's interactive approve remains the gate):
./deploy/ops dev apply
```

The Helsinki node's scoped S3 secret is a sensitive output — seal it into the
vault, never commit it:

```sh
AWS_PROFILE=eleven-dev tofu output -raw fi_node_secret_key   # → vault, in your terminal
```